Turn MTA-STS back on

Why it matters

mode: none switches the policy off, so senders go back to delivering mail without requiring TLS. This is normal while retiring MTA-STS but not if you want the protection.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. If MTA-STS was deliberately turned off, leave it. Otherwise change mode: none to mode: testing, add the mx: lines for your MX hosts and a short max_age (86400), and change the id in the TXT record.
2. Replace the mx lines in the snippet with your own MX host names, written exactly as they appear in your MX records.
3. Publish a TLS-RPT record, watch the reports for a few weeks, then move to mode: enforce (see the testing-mode fix).

version: STSv1
mode: testing
mx: YOUR-MX-HOST.example
mx: *.YOUR-MX-DOMAIN.example
max_age: 86400

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record